The easy and foolproof way is to make sure
sendmail doesn't run all the time and listen
on port 25, and that inetd isn't calling
sendmail for any incoming traffic on port
25. I believe this is the default. You can
test this by trying to telnet into port 25:

telnet localhost 25

If you get "Connection refused", then
it means the port isn't open, so nobody
should be able to send mail to or through
your system from the outside world (at
least, not via smtp).

If your system has been configured so
that sendmail is listening, the telnet
command above should give you a connection
and probably a 220 response. (You can use
the quit command to get back out to your
regular shell prompt.) In that case, you
definitely need to investigate this
further.

If you do need to be able to send mail to
or through your mac from the outside world,
then a more complicated solution is needed,
such as authentication.